Surviving the Shai-Hulud era: runtime scanning and an SBOM that actually blocks something
A worm that harvests your tokens and republishes itself through your own packages doesn't care how careful you were last quarter. What I changed in our pipelines afterwards — and which parts of it were worth the trouble.
